Tools / System Design
1. Difference between horizontal and vertical scaling.
Horizontal Scaling also referred to as "scale-out" is the addition of more machines or setting up a cluster/distributed environment for your software system. This usually requires a load-balancer program which is a middleware component in the standard 3 tier client-server...
2. What is a Load Balancer?
Load balancer is responsible to distribute user requests (load) among the various back-end systems/nodes in the cluster. Each of these back-end machines runs a copy of your software and hence capable of servicing requests....
3. Explain few load balancing algorithms that you know.
Round Robin also called as "Next in Loop". Weighted Round Robin , similar to Round Robin, but some servers get a larger share of the overall traffic....
4. Explain CAP theorem.
The CAP theorem, also known as Brewer's theorem , states that it is impossible for a distributed data store to simultaneously provide more than two out of the following three guarantees: Consistency: Every read receives the most recent write or...
5. Explain the BASE property of the database.
Basically Available indicates that the system does guarantee availability, in terms of the CAP theorem. Soft state indicates that the state of the system may change over time, even without input....
6. What is database sharding?
A database shard is a horizontal partition of data in a database. Each individual partition is referred to as a database shard....
7. Difference between database sharding and partitioning.
Partitioning is a general term used to describe the act of breaking up your logical data elements into multiple entities for the purpose of performance, availability, or maintainability. Sharding is the equivalent of " horizontal partitioning "....
8. Difference between eventual and strong consistency in Distributed Databases.
Eventual consistency makes sure that data of each node of the database gets consistent eventually. Time taken by the nodes of the database to get consistent may or may not be defined....
9. How to choose between SQL and No-SQL Database?
SQL database is a better choice for any business that has the pre-defined structure and set schemas. Applications that involve multi-row transactions - like accounting systems, warehousing, payment systems can be benefitted using SQL database....
10. What is TLS?
Transport Layer Security (TLS) is a cryptographic protocol that provide communications security over a computer network. The TLS protocol aims primarily to provide privacy and data integrity between two communicating computer applications that ensure private connection and maintain integrity.
11. Explain Request Throttling.
Throttling is a process that is used to control the usage of APIs by consumers during a given period. You can define throttling at the application level and API level.
12. Difference: hard vs soft real-time system.
Hard real-time expects every hit must meets its deadline. Hard real-time systems very few and used in medical and defense fields....
13. What is NAT-T (NAT Traversal)?
Nat Traversal also known as UDP encapsulation allows traffic to get to the specified destination when a device does not have a public address. This is usually the case if your ISP is doing NAT, or the external interface of...
14. What does HLS stand for?
HLS stands for HTTP Live Streaming . HLS is a media streaming protocol for delivering visual and audio media to viewers over the internet....
15. Security measures to follow when you are developing your projects.
Perform security tests in CD/CD: CI/CD processes and tools are great places to include security tools and security uni-test cases. Generally, developers are amenable to fixing flagged vulnerabilities on merges but more resistant to addressing large security coding problems prior...
16. Explain about EquiFax 2017 security incident.
In July 2017, Equifax suffered a breach, disclosing 150 million customer records. The exploit was due to a known vulnerability in the Apache struts2 library....
17. Different Injection defects.
Cross-site scripting (XSS), SQL injection, Command injection, Insecure redirects, Insecure file upload/download, and Buffer overflow.
18. Different Authentication & access control defects.
Insufficient authentication, Insufficent authorization, Parameter tampering, and Cross-Site request forgery (CSRF).
19. Causes of Data protection defects.
Insecure cryptographic algorithm, Insecure password management, Insecure session management, and information exposure.
20. What is Cross-site scripting?
Cross-site scripting (XSS) occurs when malicious code is included in an HTML response, that alters the way the page is rendered. The malicious data is interpreted as script and executed on the client's browser....
21. What is SQL injection?
SQL injection is the highest application security concern because it's well known, easy to perform and operates on the database server. SQL injection occurs when: Malicious data is used to construct SQL statements via string concatenation, thus commingling executable code...
22. Explain Command injection.
Command injections attacks exploit application functionality that makes system calls or commands using untrusted data. Attacks become possible when an application passes unsafe user-supplied data such as forms, cookies, and HTTP headers to the system as part of a shell...
23. What is meant by Insecure redirects?
This type of injection defects occur where untrusted data redirects used to faulty/malicious sites. Redirects allows web application to direct users to different pages within the same application or to an external site....
24. Explain about "insecure upload/download" injection defect.
Uploading/downloading files in an insecure manner is a broad type of risk that covers path manipulation, data caching, file handling, malware and anti-virus, access control, and bandwidth concerns. Path manipulation is a major concern....
25. What is the "Buffer overflow" attack?
Buffer overflow occurs when an application writes more data into an area of memory, called a buffer than was intended. Buffers are created to contain a finite amount of data....
26. Differentiate Authentication and Authorization.
Authentication is the act of proving one's identity. Authorization is the act of proving one's access privileges....
27. What is parameter tampering?
Parameter tampering, also known as insecure direct object reference, occurs when attackers manipulate parameters exchanged between client and server to gain access unauthorized access to data. Examples of parameter values frequently manipulate include: cookies.
28. What is Cross-site request forgery (CSRF)?
Cross-site request forgery (CSRF) occurs when a malicious website, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site where the user is currently authenticated. These attacks can make use...
29. What is SACM (Service Asset and Configuration management)?
SACM is a primary information technology-business process that is foundational and required to mitigate system vulnerabilities and risk of cyberattacks against any organization. It is a collection of processes that achieve operational control, systematic onboarding, validation, updates, maintenan
30. What is digital accessibility?
Digital accessibility is about making digital products and services accessible to those with disabilities. A website, application or document is accessible when a person with diverse abilities can use it to perform the task or access the service for which...
31. What is WAI-ARIA?
WAI-ARIA, the A ccessible R ich I nternet Applications Suite, defines a way to make Web content and the Web applications more accessible to people with disabilities . It especially helps with dynamic content and advanced user interface controls developed...
32. What is VUI?
VUI stands for Voice User Interface . It allows the user to interact with a system through voice or speech commands.
33. What are Alexa skills?
It is nothing but a application for Alexa. Ease of Access.
34. What is DNS TXT record?
A TXT record is a type of resource record in the Domain Name System(DNS) used to provide the ability to associate arbitrary text with a host or other names, such as human-readable information about a server, network, data center, or...
35. What is Resident Set Size (RSS)?
Resident Set Size (RSS) is the amount of RAM your process is consuming.
36. Explain 12-Factor App methodology.
The Twelve(12)-Factor App methodology is a methodology for building software-as-a-service applications. These best practices are designed to enable applications to be built with portability and resilience when deployed to the web.
37. What is certificate pinning?
Certificate pinning restricts which certificates are considered valid for a particular website, limiting risk. Instead of allowing any trusted certificate to be used, operators "pin" the certificate authority (CA) issuer(s), public keys, or even end-entity certificates of their choice....
38. Difference between SSL authentication and Mutual SSL Authentication.
In SSL authentication, the client is presented with a server's certificate, the client computer might try to match the server's CA against the client's list of trusted CAs. If the issuing CA is trusted, the client will verify that the...
39. What is OAUTH?
OAuth (Open Authorization) is an open standard for access delegation, commonly used as a way for Internet users to grant websites or applications access to their information on other websites but without giving them the passwords.
40. What is a Canary release?
A canary release is a software testing technique used to reduce the risk of introducing a new software version into production by gradually rolling out the change to a small subgroup of users, before rolling it out to the entire...
41. What is Domain Driven Design?
Domain-Driven Design is a way of looking at software from top-down. When we are developing software our focus shouldn't be primarily on technology, it should be primarily on business or whatever activity we are trying to assist with the software,...
42. Difference between TLS and MTLS.
Transport Layer Security (TLS) is an encryption protocol in wide use on the Internet. TLS, which was formerly called SSL, authenticates the server in a client-server connection and encrypts communications between client and server so that external parties cannot spy...
43. What is RSocket?
RSocket is an open-source streaming message protocol with Reactive Extension/Stream semantics initially created by Netflix. The main difference between RSocket and traditional TCP web socket is, RSocket is flexible and adds reactive streams.
44. What is Site reliability engineering (SRE)?
As per Wikipedia, Site reliability engineering is a set of principles and practices that incorporates aspects of software engineering and applies them to infrastructure and operations problems. The main goals are to create scalable and highly reliable software systems.
45. Difference Between Semaphore and Mutex.
The Mutex is a locking mechanism that makes sure only one thread can acquire the Mutex at a time and enter the critical section. This thread only releases the Mutex when it exits the critical section....
46. What is Privilege Escalation?
Privilege escalation is a type of network attack used to gain unauthorized access to systems within a security perimeter. Attackers start by finding weak points in an organization's defenses and gaining access to a system....
47. What is SSRF?
SSRF stands for server-side request forgery, are designed to exploit how a server processes external information. The primary purpose of the attack is to gain access to sensitive information/data....
48. Best practices for Strong cryptography.
Make sure you don't use algorithms that have known weaknesses such as MD5/SHA1, Data Encryption Standard (DES), and instead, use cryptographically strong APIs provided by your programming languages such as Advanced Encryption Standard (AES) (>=128 bits),and SHA256 (>=256-bits).
49. Define Latency and throughput.
Latency is the time taken in milliseconds for delivering a single message or getting a response. Throughput is the amount of data successfully transmitted through a system in a given amount of time.
50. What is Insecure Design?
Insecure design encompasses various risks that arise from ignoring design and architectural best practices, starting from the planning phase before actual implementation. A near-perfect implementation cannot prevent defects arising from an insecure design.
51. What is threat modeling?
Threat modeling is a procedure for optimizing the applications, system, or business process security by identifying objectives and vulnerabilities, and then defining countermeasures to prevent or mitigate the effects of threats to the system. There are many different threat modeling...
52. Explain STRIDE threat modeling.
Microsoft developed the STRIDE methodology in the late 1990s as a way to standardize the identification of threats across their product line. It offers a mnemonic for identifying security threats in six categories: Spoofing : An intruder posing as another...
53. What is meant by tokenization?
Tokenization refers to a process by which a piece of sensitive data, such as a credit card number, is replaced by a surrogate value known as a token. It is the process of replacing sensitive data with unique identification symbols...
54. What is the PACELC theorem?
In theoretical computer science, the PACELC theorem is an extension of the CAP theorem. It states that in the case of network partitioning (P) in a distributed computer system, one has to choose between availability (A) and consistency (C) (as...
55. What is a denial of service attack (DoS)?
A Denial-of-Service (DoS) attack is an attack meant to shut down a machine or network, making it inaccessible to its intended users. DoS attacks accomplish this by flooding the target with traffic or sending it information that triggers a crash....
56. What is a Finite State Machine (FSM)?
A Finite State Machine, or FSM, is a computation model that can be used to simulate sequential logic, or, in other words, to represent and control execution flow. Finite State Machines can be used to model problems in many fields,...
57. What is SNAT (Secure network address translation)?
Secure network address translation (SecureNA or SNAT) is a network address translation (NAT) technique that enables private network security by providing a public Internet Protocol (IP) address to remote users/systems.
58. What is Global Traffic Manager (GTM)?
GTM load balancer balances traffic for application servers across Data Centers. Global Traffic Manager is a load balancing solution that operates at the DNS level, directing traffic across multiple geographically dispersed data centers....
59. What is Local Traffic Manager (LTM)?
Local Traffic Manager focuses on load balancing within a single data center or location. It operates at the application layer, intelligently distributing traffic across multiple servers to ensure efficient resource utilization and optimal performance....
60. Difference: API Gateway, Load Balancer, and Reverse Proxy.
Core Purpose API Gateway Load Balancer Reverse Proxy Main Job Manage multiple API services Distribute traffic Optimize web apps Scope Different services Same service Single web application Auth Advanced Basic Basic Smart Routing Yes ALB - Yes NLB - No...
61. What is CUDA?
CUDA (Compute Unified Device Architecture) is a parallel computing platform and programming model created by NVIDIA that allows software to use NVIDIA GPUs for general-purpose computing (GPGPU), not just graphics. It significantly speeds up applications in AI, scientific simulation, and...
